Quick answer

If a lending app or collector posts your name, photo, loan details, contact information, or insulting or threatening accusations online, preserve the evidence before asking for removal. Then report the post to the platform, send a written complaint to the lender, and escalate to the government agency with jurisdiction:

SEC for most lending and financing companies;
National Privacy Commission (NPC) when personal data was misused or disclosed;
BSP when the creditor is a BSP-supervised institution, such as a bank or non-bank electronic-money issuer; and
NBI Cybercrime Division or the PNP Anti-Cybercrime Group when the post may involve cyber libel, threats, identity theft, or another crime.

A real unpaid loan does not give a lender or collector unlimited authority to shame, threaten, or expose a borrower. Reporting abusive collection also does not automatically erase a legitimate debt. Keep payment discussions separate and deal only through verified, documented channels.

What conduct should be reported?

Report the post if it does one or more of the following:

Publicly identifies you as a borrower or discloses your balance, due date, account details, identification documents, address, phone number, employer, or other personal data without a lawful basis;
Uses your photograph, ID, profile, or edited “wanted,” “scammer,” or similar image to embarrass you;
Tags or messages relatives, friends, co-workers, clients, or your employer to pressure you;
Uses information taken from your phone contacts, social-media contacts, gallery, or other app permissions for harassment;
Falsely claims that a character reference is a co-maker or guarantor;
Threatens violence, arrest, public exposure, property damage, or an action the collector cannot legally take;
Uses obscenities, insults, humiliating language, or false accusations;
Pretends to be a court, police officer, lawyer, or government agency;
Creates an account in your name, impersonates you, or publishes altered documents; or
Continues posting after the lender has been notified that the information is wrong, excessive, or unlawfully disclosed.

Under SEC Memorandum Circular No. 18, Series of 2019, lending and financing companies—and the collectors and service providers acting for them—must not use unfair collection practices. These include threats of violence or criminal means, threats of actions that cannot legally be taken, insults or obscenities, disclosure or publication of borrowers’ personal information, and communicating loan information to persons who are not legally liable for the debt, subject to the circular’s specific exceptions.

The Financial Products and Services Consumer Protection Act also prohibits financial service providers from using abusive collection or debt-recovery practices and makes providers accountable for covered third-party service providers involved in debt collection.

A character reference is not automatically a guarantor

A collector cannot treat every person listed as a reference—or everyone found in your phone—as responsible for your loan.

The NPC’s amended loan-data rules distinguish a character reference, whose information is supplied to help verify the borrower’s identity or representations, from a guarantor, who expressly binds himself or herself to answer for the obligation. Processing a reference’s information must not become excessive, disproportionate, or a means of harassment. Collection efforts directed at persons other than an actual guarantor may violate privacy and fair-collection rules. See NPC Circular No. 2022-02.

Whether someone is genuinely a guarantor depends on the documents and applicable law—not merely on what the collector calls that person in a message or post.

Preserve evidence before the post disappears

Do this before blocking the account or requesting removal:

Capture the entire post. Take screenshots showing the text, photographs, account name, profile, date and time, comments, reactions, and visible URL.
Save the direct link. Copy the post, profile, video, group, or page URL. A cropped screenshot without a source link may be harder to authenticate.
Make a screen recording. Begin with the account profile, open the post, scroll through it, and show the URL and surrounding context.
Preserve messages and call records. Export chats where possible. Save SMS messages, emails, voice messages, call logs, and collection notices.
Record the timeline. Note when you first saw the post, who sent it to you, when it was edited or deleted, and every complaint you made.
Ask witnesses to preserve their copies. If relatives, colleagues, or customers received messages or saw the post, ask them to retain the original material and identify when and how they received it.
Keep the loan records. Save the contract, disclosure statement, repayment history, receipts, app name and version, privacy notice, permissions requested, collector’s number, and the lender’s corporate name.
Preserve proof of harm. Keep employer messages, lost-client communications, medical or counseling records, and other documents if they genuinely relate to the publication.

Store unedited originals in at least two secure locations. Do not add annotations to the only copy. Make a separate redacted copy when sending evidence to people who do not need to see IDs, account numbers, or sensitive information.

Report the post to the platform

Use the platform’s reporting function after preserving the evidence. Choose the most accurate ground available, such as:

Harassment or bullying;
Threats or violence;
Sharing private or personal information;
Impersonation;
Fraud or scam;
Non-consensual use of an image; or
Defamation, where the platform offers that category.

Report both the individual post and the collector’s account or page when appropriate. Save the report confirmation, case number, emails, and platform response.

If the post appears in a private group, ask a group administrator to preserve and remove it. Do not repeatedly repost the material to “expose” the collector; republication can spread your personal information further and may complicate the dispute.

Platform removal is useful, but it is not a substitute for a complaint to the lender, regulator, or law-enforcement agency.

Send a written complaint and preservation demand

Write to the lender’s consumer-assistance unit, compliance officer, and data-protection officer using contact details you independently verify. Do not rely only on the collector’s mobile number.

Your complaint should state:

Your full name and loan or account reference, with unnecessary digits masked;
The app’s name and the lender’s complete corporate name, if known;
The collector’s name, account, phone number, or email address;
The post’s URL, date, platform, and a short factual description;
Which information is false, private, excessive, or unlawfully disclosed;
Whether relatives, an employer, or other third parties were contacted;
The action requested: stop publication and third-party contact, remove the material, correct inaccurate data, identify the collecting agency, preserve records, investigate, and provide a written result; and
A reasonable deadline for urgent removal, while making clear that all relevant records must be preserved.

Attach copies, not your only originals. Request written acknowledgment and keep proof of delivery. A lender remains accountable for personal data under its control and cannot avoid responsibility merely by outsourcing collection.

For an NPC complaint, this written notice is especially important. The NPC generally requires the complainant to first inform the respondent in writing and give it an opportunity to act. If there is no response within 15 calendar days from receipt, or the response is not timely or appropriate, attach proof of that fact to the complaint. Exceptional circumstances may affect the exhaustion requirement, so obtain legal advice if waiting could expose you or another person to serious harm.

File with the correct regulator

SEC: lending or financing company

Most stand-alone online lending platforms are operated by lending or financing companies regulated by the Securities and Exchange Commission. A lending company may not lawfully conduct lending business without SEC authority under the Lending Company Regulation Act of 2007.

Submit the complaint through the SEC iMessage portal or the SEC’s currently published Financial and Lending Company Division channel. Include:

The app and corporate names;
The app-store or website link;
The loan agreement and proof of payments;
Screenshots, post URLs, messages, and call logs;
The collector’s identifiers;
Your complaint to the company and its response; and
Any reason you believe the operator is unregistered or is using a different company’s identity.

Ask the SEC to examine both the unfair collection practice and the operator’s authority to conduct lending activities. Do not assume that an app-store listing means the lender is SEC-authorized.

NPC: misuse or disclosure of personal data

File with the National Privacy Commission if the lender or collector accessed, used, or disclosed personal information in a manner that may violate the Data Privacy Act or NPC loan-processing rules.

Online lending apps must not conduct unnecessary or excessive processing. Permissions must be suitable and necessary for a legitimate purpose, and access should cease when that purpose has been fulfilled. Personal data cannot be used to engage in unfair collection. The NPC explains these restrictions in its guidance on online lenders and contact lists and in NPC Circular No. 2022-02.

Follow the NPC’s current formal complaint instructions. As of the source-check date, the NPC requires its current complaint-affidavit or complaint-assisted form, properly completed and notarized, with supporting evidence and witness affidavits where available. Filing may be made personally, by registered mail, courier, or authorized electronic mail, subject to the NPC’s format, signature, copy, and fee requirements.

Attach:

Proof that you notified the respondent in writing;
Proof of receipt and the response, or proof that 15 calendar days passed without one;
Screenshots, URLs, and original electronic records;
The loan contract and privacy notice;
Evidence of the app permissions involved;
Messages received by contacts or witnesses;
Proof connecting the app, lender, and collector; and
A clear explanation of what personal data was processed and why you say it was unauthorized, unnecessary, excessive, inaccurate, or maliciously disclosed.

Use the NPC’s latest form. The Commission announced that a new complaint-affidavit template took effect on July 1, 2025, replacing the previous version after the stated transition period.

BSP: bank or other BSP-supervised institution

If the creditor is a bank, non-bank electronic-money issuer, pawnshop, money-service business, operator of a payment system, or another BSP-supervised financial institution, first complain to the institution’s consumer-assistance unit. If unresolved, escalate through the BSP Consumer Assistance Mechanism, including the BSP Online Buddy or the current Complaints, Inquiries and Requests form.

The name appearing on the app may differ from the regulated entity that actually granted the loan. Check the agreement and disclosure documents before choosing the regulator.

CDA: lending cooperative

If the creditor is genuinely a cooperative rather than a lending corporation, contact the Cooperative Development Authority and follow its applicable complaint or consumer-redress process. Internal conciliation, mediation, or other preliminary procedures may apply depending on the dispute and your relationship with the cooperative.

When to approach the NBI or PNP

Consider reporting promptly to the NBI Cybercrime Division or PNP Anti-Cybercrime Group if the conduct includes:

A credible threat of physical harm;
Extortion or a demand backed by a threat to publish more information;
Impersonation or creation of a false account in your name;
Hacking, unauthorized account access, or computer-related identity theft;
Fabricated or altered documents;
Repeated online publication of potentially defamatory accusations; or
Coordinated harassment that creates an immediate safety risk.

The NBI’s process for victims of computer crimes provides for a complaint form, sworn statements or affidavits, supporting documents, and examination of relevant devices. The NBI also maintains an online complaint page and a directory of regional and district offices.

Bring a valid ID, a concise incident timeline, original devices if requested, unedited electronic evidence, printed copies, URLs, witness details, and proof connecting the collector to the lender. Investigators or prosecutors—not the complainant—will determine the appropriate charge.

Call emergency services or go to the nearest police station immediately if a threat appears imminent. Do not arrange an in-person meeting with a threatening collector merely to gather evidence.

Is every malicious post cyber libel?

No. A cruel, embarrassing, or inaccurate post is not automatically criminal cyber libel.

Cyber libel applies the Revised Penal Code’s law on libel to publication through a computer system. Liability depends on facts such as the words used, identifiability of the person, publication to a third person, defamatory meaning, malice and applicable privileges or defenses. Truth, good motives, privileged communications, authorship, and the surrounding context may be legally important.

The Supreme Court has held that cyber libel prescribes in one year from discovery. Because delay can defeat a criminal complaint—and evidence or account records may disappear—seek advice promptly rather than waiting for the post to be repeatedly shared. See the Supreme Court’s 2026 resolution in Causing v. People and its official summary of the prescription ruling.

Other offenses may have different elements and deadlines. Do not select a criminal charge based only on the label used on a complaint form.

Does reporting the collector cancel the loan?

Usually, no. A privacy, regulatory, or criminal complaint concerns the method of collection or publication. It does not by itself decide whether the loan is valid, how much is legally due, or whether interest and charges are enforceable.

Continue to:

Request a written statement of account;
Compare it with the signed agreement and disclosure statement;
Dispute incorrect charges in writing;
Pay only through an independently verified official channel;
Obtain an official receipt; and
Keep records of any proposed restructuring or settlement.

Do not send money to a collector’s personal account merely because the collector threatens another post. Confirm payment instructions directly with the regulated entity.

The Constitution provides that no person shall be imprisoned merely for debt. That rule does not protect separate criminal conduct, such as fraud or the issuance of a worthless check where the legal elements are present. A collector’s claim that ordinary nonpayment automatically means immediate arrest is misleading. See Article III, Section 20 of the 1987 Constitution.

Common mistakes to avoid

Deleting the app or blocking the collector before preserving evidence. This may remove messages, permissions, account details, or links.
Saving only cropped screenshots. Capture the account, URL, date, context, and comments.
Arguing publicly. Public replies may spread the disclosure and create new legal issues.
Threatening the collector in return. Keep communications factual and controlled.
Sending IDs without redaction. Disclose only what the receiving authority actually requires and use its official channel.
Naming only the app. Identify the corporate lender, collecting agency, and individual collector where possible.
Filing an NPC complaint without prior written notice. Unless an exception applies, failure to exhaust remedies may cause dismissal.
Calling every offensive statement cyber libel. The elements, evidence, authorship, defenses, and deadline must be assessed.
Assuming that a privacy complaint erases the balance. Continue addressing any legitimate obligation separately.
Waiting for more posts. Preserve the first publication and act promptly, especially where criminal prescription may be running.

When legal help is urgent

Consult a Philippine lawyer, the Public Attorney’s Office if you qualify, or another legitimate legal-assistance provider promptly when:

The post was discovered close to one year ago;
The collector threatens violence, arrest, workplace disruption, or publication of intimate material;
Your identity or account has been taken over;
A child’s information or image was disclosed;
Court papers, a subpoena, or a prosecutor’s notice has arrived;
The lender denies responsibility for the collector;
The operator appears unlicensed or uses multiple identities;
You suffered job loss, measurable business loss, or serious psychological harm;
You are considering a damages case or an application for urgent court relief; or
The complaint involves several victims, several companies, or evidence stored abroad.

A lawyer should review the exact post, loan documents, dates, and available electronic evidence before advising on criminal, civil, administrative, or injunctive remedies.

FAQ

May a collector contact my family or employer?

Not simply to shame you or disclose your debt. Whether a limited communication is lawful depends on its purpose, the information revealed, and whether the recipient is an actual guarantor or otherwise legally involved. Mass messaging, public tagging, or disclosing loan details to unrelated persons is a serious warning sign.

I allowed the app to access my contacts. Does that authorize public shaming?

Not necessarily. Consent and app permissions do not permit unlimited processing. Collection and use must still have a lawful, declared, necessary, and proportionate purpose. Information obtained through a permission cannot lawfully be repurposed for harassment or unfair collection.

Can the lender use my profile photo in a collection post?

A photograph is personal information when it identifies you. Using it in a humiliating collection notice may raise both privacy and unfair-collection issues, even if the photo was publicly visible elsewhere.

What if the post correctly says I have an unpaid loan?

Accuracy alone does not automatically justify public disclosure. The lender must still comply with privacy, fair-treatment, and collection rules. At the same time, a truthful statement is assessed differently from a fabricated accusation in any libel analysis.

Can I complain if I am only a contact person?

Yes, if your own personal data was processed or you were harassed. A contact person is a separate data subject and does not lose privacy rights because a borrower stored that person’s number.

Should I uninstall the lending app?

First document the app’s name, developer, privacy notice, permissions, account information, messages, and relevant screens. After preserving evidence, revoke unnecessary permissions, secure your accounts, and uninstall if appropriate. Changing passwords and reviewing connected sessions may also be prudent if you suspect unauthorized access.

Can I demand that the post be deleted immediately?

You may demand prompt removal, correction, cessation of further disclosure, and preservation of evidence. Whether an authority can compel removal, award damages, or impose sanctions depends on its jurisdiction, procedure, and findings.

Where should I file if I do not know who regulates the lender?

Check the loan agreement, disclosure statement, receipt, privacy notice, app-store developer information, and payment beneficiary. Start with the entity’s full legal name. SEC iMessage, the BSP consumer channel, or the relevant regulator can then evaluate jurisdiction, but you may need to file separately with the NPC when misuse of personal data is involved.

Official references

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. The correct remedy depends on the post, loan documents, parties, dates, and evidence. Laws, agency forms, filing channels, and procedures were checked against official sources current as of August 30, 2026.